744538 - Security Review:Can't transfer File objects with postMessage cross domain

Status: RESOLVED FIXED

(mozilla.org :: Security Assurance: Review Request, task)

Description

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Who is/are the point of contact(s) for this review?
    
Please provide a short description of the feature / application (e.g. problem solved, use cases, etc.):
    
Please provide links to additional information (e.g. feature page, wiki) if available and not yet included in feature description:
    
Does this request block another bug? If so, please indicate the bug number This review will be scheduled amongst other requested reviews. What is the urgency or needed completion date of this review?

Please answer the following few questions: (Note: If you are asked to describe anything, 1-2 sentences shall suffice.)

Does this feature or code change affect Firefox, Thunderbird or any product or service the Mozilla ships to end users?

Are there any portions of the project that interact with 3rd party services?

Will your application/service collect user data? If so, please describe 

If you feel something is missing here or you would like to provide other kind of feedback, feel free to do so here (no limits on size):

Desired Date of review (if known from https://mail.mozilla.com/home/[e-mail]/Security%20Review.html) and whom to invite.

Comment 1

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Is this project going forward and when should we be looking at doing a review?

Comment 2

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

We decided we don't need secreview to proceed here.

Comment 3

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Who is we? When this was originally nominated the security team felt this did need to be looked at, I know dveditz had some concerns and I just want to make sure we cover those. This is not to say you all can't proceed but we may still need to do a review of this.

Comment 4

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

I'll let you actually WONTFIX this but we really don't think security review is necessary here.

See https://bugzilla.mozilla.org/show_bug.cgi?id=722126#c18 for the rationale.

Comment 5

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

per https://bugzilla.mozilla.org/show_bug.cgi?id=722126#c19 I'll leave the call to dveditz